W3C home > Mailing lists > Public > ietf-http-wg@w3.org > July to September 2012

Re: Privacy and its costs (was: Re: Mandatory encryption)

From: Yoav Nir <ynir@checkpoint.com>
Date: Tue, 31 Jul 2012 09:28:27 +0300
To: Mike Belshe <mike@belshe.com>
CC: Tim Bray <tbray@textuality.com>, Martin J. Dürst <duerst@it.aoyama.ac.jp>, "ietf-http-wg@w3.org" <ietf-http-wg@w3.org>
Message-ID: <DDE44BEF-501E-4353-BB41-9187DA73877C@checkpoint.com>

On Jul 30, 2012, at 9:43 PM, Mike Belshe wrote:



On Wed, Jul 18, 2012 at 8:23 PM, Tim Bray <tbray@textuality.com<mailto:tbray@textuality.com>> wrote:
Fair point; I should. -T

Yeah, belshe.com<http://belshe.com/> should too :-)

Part of the reason it is hard is because we haven't built the tools we need.  Why haven't we built better tools?  Because its too easy to opt out.  Every day, millions of site operators like bray and belshe sacrifice the needs of the Internet for their own general laziness.

If the net were secure by default and offered no option to amateur blokes like us, we'd soon have a one-liner command line mechanism to request/sign/issue/install our server certs and we'dl all be laughing about how we used to say it was "hard".

Disagree. belshe.com<http://belshe.com> is just somebody's blog. It's not financial information, there are no privacy issues, no medical data, no potentially embarrassing association with sexual minorities. Why would you want to spend any resources securing that?

And securing that has costs. There's extra CPU (although I guess the smallest server you can buy can handle your site both with and without SSL), there's the cost of certificates, there's the administrative effort in getting and deploying the certificates, and there's the loss of caching ability all over the Internet.

Sure, my bank, my HMO and mail.google.com<http://mail.google.com> need to have encryption. Yes, as long as HTTP without S exists, browsers can be tricked into doing this unencrypted. But why should you and Tim bear the cost of securing those banking sites? Let them use HSTS or some future DNS-based strict transport security.

Yoav
Received on Tuesday, 31 July 2012 06:29:41 GMT

This archive was generated by hypermail 2.2.0+W3C-0.50 : Tuesday, 31 July 2012 06:29:58 GMT